Abstract: An initialization vector (IV) is employed to decrypt a block of a stream that has been encrypted with Cypher Block Chaining (CBC) encryption, without requiring decryption of previous blocks within the stream. For example, a listener who accesses a distribution point to retrieve encrypted content authenticates himself to an application server that regulates access to encrypted content on the distribution point, and responsively receives a key. The listener then requests access to a reference point within the encrypted content stream somewhere after its beginning (e.g., using preview clips). The distribution point relates the reference point to a corresponding block of the encrypted stream, and identifies an IV previously used for encryption of that block. The distribution point provides the associated encrypted block of content and the IV to the listener to enable mid-stream rendering of the encrypted content, without requiring the listener to decrypt previous blocks within the encrypted stream.

Abstract: Techniques are provided for displaying a uniform resource locator (URL) to assist a user in determining whether a URL destination is what the user expects. A link is presented for selection to a user, and a URL corresponding to the link is accessed. A portion of the URL that corresponds to a hostname component of the URL may be identified, and the URL may be displayed. The hostname component of the URL is visually distinguished from other components of the URL. In addition to or as an alternative to displaying the URL and visually distinguishing the hostname component, a warning message relating to the hostname portion of the URL may be displayed. The techniques may be implemented as a software plug-in or in any type of software application that is capable of recognizing URLs.

Abstract: A service provider may provide one or more services to and/or for a client. Providing a service may involve receiving a service request including a security token at the service provider and determining whether the security token is valid. Providing the service may also involve determining a session security token if the security token is valid and generating a service response including the session security token. Providing the service may further involve receiving a service request including the session security token, determining whether the session security token is valid, and, if the session security token is valid, generating a second service response.

Abstract: Invoking a computer implemented service includes receiving a request from a first user to access a service associated with a second user. The request is associated with a security token for the first user and an identity token for the second user. The acceptability of the security token is determined to authenticate the first user, and the acceptability of the identity token is determined to securely identify the second user. The first user is able to access the service associated with the second user conditioned on the security token being determined to be acceptable and the identity token being determined to be acceptable.

Abstract: Invoking a computer implemented service includes receiving a request from a first user to access a service associated with a second user. The request is associated with a security token for the first user and an identity token for the second user. The acceptability of the security token is determined to authenticate the first user, and the acceptability of the identity token is determined to securely identify the second user. The first user is able to access the service associated with the second user conditioned on the security token being determined to be acceptable and the identity token being determined to be acceptable.

Abstract: A service provider may provide one or more services to and/or for a client. Providing a service may involve receiving a service request including a security token at the service provider and determining whether the security token is valid. Providing the service may also involve determining a session security token if the security token is valid and generating a service response including the session security token. Providing the service may further involve receiving a service request including the session security token, determining whether the session security token is valid, and, if the session security token is valid, generating a second service response.

Abstract: An initialization vector (IV) is employed to decrypt a block of a stream that has been encrypted with Cypher Block Chaining (CBC) encryption, without requiring decryption of previous blocks within the stream. For example, a listener who accesses a distribution point to retrieve encrypted content authenticates himself to an application server that regulates access to encrypted content on the distribution point, and responsively receives a key. The listener then requests access to a reference point within the encrypted content stream somewhere after its beginning (e.g., using preview clips). The distribution point relates the reference point to a corresponding block of the encrypted stream, and identifies an IV previously used for encryption of that block. The distribution point provides the associated encrypted block of content and the IV to the listener to enable mid-stream rendering of the encrypted content, without requiring the listener to decrypt previous blocks within the encrypted stream.

Abstract: An initialization vector (IV) is employed to decrypt a block of a stream that has been encrypted with Cypher Block Chaining (CBC) encryption, without requiring decryption of previous blocks within the stream. For example, a listener who accesses a distribution point to retrieve encrypted content authenticates himself to an application server that regulates access to encrypted content on the distribution point, and responsively receives a key. The listener then requests access to a reference point within the encrypted content stream somewhere after its beginning (e.g., using preview clips). The distribution point relates the reference point to a corresponding block of the encrypted stream, and identifies an IV previously used for encryption of that block. The distribution point provides the associated encrypted block of content and the IV to the listener to enable mid-stream rendering of the encrypted content, without requiring the listener to decrypt previous blocks within the encrypted stream.

Abstract: An initialization vector (IV) is employed to decrypt a block of a stream that has been encrypted with Cypher Block Chaining (CBC) encryption, without requiring decryption of previous blocks within the stream. For example, a listener who accesses a distribution point to retrieve encrypted content authenticates himself to an application server that regulates access to encrypted content on the distribution point, and responsively receives a key. The listener then requests access to a reference point within the encrypted content stream somewhere after its beginning (e.g., using preview clips). The distribution point relates the reference point to a corresponding block of the encrypted stream, and identifies an IV previously used for encryption of that block. The distribution point provides the associated encrypted block of content and the IV to the listener to enable mid-stream rendering of the encrypted content, without requiring the listener to decrypt previous blocks within the encrypted stream.

Abstract: An initialization vector (IV) is employed to decrypt a block of a stream that has been encrypted with Cypher Block Chaining (CBC) encryption, without requiring decryption of previous blocks within the stream. For example, a listener who accesses a distribution point to retrieve encrypted content authenticates himself to an application server that regulates access to encrypted content on the distribution point, and responsively receives a key. The listener then requests access to a reference point within the encrypted content stream somewhere after its beginning (e.g., using preview clips). The distribution point relates the reference point to a corresponding block of the encrypted stream, and identifies an IV previously used for encryption of that block. The distribution point provides the associated encrypted block of content and the IV to the listener to enable mid-stream rendering of the encrypted content, without requiring the listener to decrypt previous blocks within the encrypted stream.

Abstract: Techniques are provided for displaying a uniform resource locator (URL) to assist a user in determining whether a URL destination is what the user expects. A link is presented for selection to a user, and a URL corresponding to the link is accessed. A portion of the URL that corresponds to a hostname component of the URL may be identified, and the URL may be displayed. The hostname component of the URL is visually distinguished from other components of the URL. In addition to or as an alternative to displaying the URL and visually distinguishing the hostname component, a warning message relating to the hostname portion of the URL may be displayed. The techniques may be implemented as a software plug-in or in any type of software application that is capable of recognizing URLs.

Abstract: An identity based service system is provided, in which an identity is created and managed for a user or principal, such that at least a portion of the identity is available to use between one or more system entities. A discovery service enables a system entity to discover a service descriptor, given a service name and a name identifier of the user, whereby system entities can find and invoke the user's other personal web services. The discovery service preferably provides a translation between a plurality of namespaces, to prevent linkable identity information over time between system entities.

Abstract: An apparatus and method is provided for allowing users to share services without sharing identities. Specifically, the apparatus and method allow users to share pseudonyms instead of actual user names, thus protecting both users from unwanted emails, IM messages, and the like. The invention provides an introduction scheme, which comprises a simple and secure way of establishing a user to user link. A preferred embodiment incorporates services of a linked federation network service, such as AOL's Liberty Alliance service, without exposing real user names to other users.

Abstract: A method and apparatus is provided for invoking authenticated transactions on behalf of a user when the user is not present. For example, the invention allows a subscription to take actions that would otherwise require authentication, such as performing collections from a wallet, when the user is not present. Thus, the invention provides a form of delegation of authority.

Abstract: An apparatus and method is provided for allowing users to share services without sharing identities. Specifically, the apparatus and method allow users to share pseudonyms instead of actual user names, thus protecting both users from unwanted emails, IM messages, and the like. The invention provides an introduction scheme, which comprises a simple and secure way of establishing a user to user link. A preferred embodiment incorporates services of a linked federation network service, such as AOL's Liberty Alliance service, without exposing real user names to other users.

Abstract: The invention comprises Web services in which the sharing of XML documents containing user information between Web service providers (WSPs) and Web service clients (WSCs) provides WSPs with views/filters for different levels of WSC access. Additionally, in the invention a WSC can only view the portion of a user's XML file that its WSC group is allowed to view, as a result of action of the filters on the WSP.

Abstract: A method and system for transforming and manipulating program object code. A set of program object code is transformed into a form in which it may be readily manipulated, preferably a form which is independent of both the processor and the operating system with which the object code will execute. The transformed object code is manipulated, preferably to add error-checking instructions, but possibly to add other functions or to alter the functions of the object code. The manipulated code is then reverse-transformed to program object code of the same type as the original object code.